Detection rules › Sublime MQL

Sublime MQL rules: job

Rule	Severity
Job scam with specific salary pattern	`low`

Job scam with specific salary pattern

Severity: low
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects job scam content that includes specific weekly salary mentions (e.g., '$XXX weekly' patterns) in either the current email thread or previous thread conversations, while excluding legitimate income verification services.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	BEC/Fraud
Tactics and techniques	Social engineering

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
body.previous_threads
headers
headers.auth_summary
sender.email
type

Rule body

type.inbound
and (
  (
    // job scam in current thread
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("job_scam") and .confidence != "low"
    )
    // and salary mention in current thread
    and regex.icontains(body.current_thread.text,
                        '\$\d{3} weekly',
                        'weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]'
    )
  )
  // job scam in previous thread
  or any(body.previous_threads,
         any(ml.nlu_classifier(.text).intents,
             .name in ("job_scam") and .confidence != "low"
         )
         // and salary mention in previous thread
         and regex.icontains(.text,
                             '\$\d{3} weekly',
                             'weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]'
         )
  )
)
and length(body.current_thread.links) < 10

// negating income / job verification senders
and not (
  sender.email.domain.root_domain in (
    'loandepot.com',
    'sofi.com',
    'lensa.com',
    'indeed.com',
    'ziprecruiter.com',
    'glassdoor.com',
    'postjobfree.com',
    'jobplacements.com'
  )
  and headers.auth_summary.dmarc.pass
)

Detection logic

Scope: inbound message.

inbound message
any of:
- all of:
  - any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
    
    .name in ('job_scam')
    .confidence is not 'low'
  - body.current_thread.text matches any of 2 patterns
    
    \$\d{3} weekly
    weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]
- any of body.previous_threads where all hold:
  - any of ml.nlu_classifier(.text).intents where all hold:
    
    .name in ('job_scam')
    .confidence is not 'low'
  - .text matches any of 2 patterns
    
    \$\d{3} weekly
    weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]
length(body.current_thread.links) < 10
not:
- all of:
  - sender.email.domain.root_domain in ('loandepot.com', 'sofi.com', 'lensa.com', 'indeed.com', 'ziprecruiter.com', 'glassdoor.com', 'postjobfree.com', 'jobplacements.com')
  - headers.auth_summary.dmarc.pass

Inspects: body.current_thread.links, body.current_thread.text, body.previous_threads, body.previous_threads[].text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: ml.nlu_classifier, regex.icontains.

Indicators matched (4)

Field	Match	Value
`ml.nlu_classifier(body.current_thread.text).intents[].name`	member	`job_scam`
`regex.icontains`	regex	`\$\d{3} weekly`
`regex.icontains`	regex	`weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]`
`ml.nlu_classifier(body.previous_threads[].text).intents[].name`	member	`job_scam`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(body.previous_threads)
      and
        any(ml.nlu_classifier(body.previous_threads.text).intents)
          and
            ml.nlu_classifier(body.previous_threads[].text).intents[].confidence ne "low"
            ml.nlu_classifier(body.previous_threads[].text).intents[].name eq "job_scam"
        or
          body.previous_threads.text regex_match "\\$\\d{3} weekly"
          body.previous_threads.text regex_match "weekly(?:\\s+\\w+){0,4}\\s+\\$\\d{3}[^\\d]"
    and
      any(ml.nlu_classifier(body.current_thread.text).intents)
        and
          ml.nlu_classifier(body.current_thread.text).intents.confidence ne "low"
          ml.nlu_classifier(body.current_thread.text).intents.name eq "job_scam"
      or
        body.current_thread.text regex_match "\\$\\d{3} weekly"
        body.current_thread.text regex_match "weekly(?:\\s+\\w+){0,4}\\s+\\$\\d{3}[^\\d]"
  not
    and
      headers.auth_summary.dmarc.pass eq "true"
      sender.email.domain.root_domain in ["glassdoor.com", "indeed.com", "jobplacements.com", "lensa.com", "loandepot.com", "postjobfree.com", "sofi.com", "ziprecruiter.com"]
  body.current_thread.links length_compare "10"
  type.inbound eq "true"

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`headers.auth_summary.dmarc.pass`	eq	`true`	`excludes:headers.auth_summary.dmarc.pass` `field:"headers.auth_summary.dmarc.pass" value:"true"`
`sender.email.domain.root_domain`	in	`glassdoor.com`, `indeed.com`, `jobplacements.com`, `lensa.com`, `loandepot.com`, `postjobfree.com`, `sofi.com`, `ziprecruiter.com`	`excludes:sender.email.domain.root_domain`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`body.current_thread.text`	regex_match	`$\d{3} weekly` `weekly(?:\s+\w+){0,4}\s+$\d{3}[^\d]`	`field:"body.current_thread.text" kind:regex_match`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`